search

code-423n4 / 2023-09-reserve-mitigation-findings

0 stars 0 forks source link

M-09 MitigationConfirmed #35

Open c4-submissions opened 1 year ago

c4-submissions commented 1 year ago

Lines of code

Vulnerability details

Lines of code

https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/RTokenAsset.sol#L163-L175 https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/RTokenAsset.sol#L53-L69 https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/p1/BasketHandler.sol#L329-L351

Vulnerability details

A vulnerability was identified in the RTokenAsset smart contract where the price oracle could return a significantly higher but valid price whenever any underlying collateral's price oracle times out, specificaly in tryPrice() which did not previously validate the obtained price range from the basketHandler.price() call.

Mitigation

PR #917 The sponsor responded by adding require statement in tryPrice() to ensure that the returned price range is validated to prevent an invalid high price as suggested by the warden.

Conclusion

The identified vulnerability has been successfully mitigated with the inclusion of a validation check in tryPrice() of the RTokenAsset smart contract. The smart contract now handles the scenario of an underlying collateral's price oracle timeout in a manner that prevents distortion in RToken's oracle price.

c4-judge commented 1 year ago

thereksfour marked the issue as satisfactory